Operating a highly available automation system

ABSTRACT

To achieve an automatic adjustment of a monitoring time in an automation system with a first automation device and a second automation device, at least one of the two automation devices operates a measuring program. A desired ring interruption is carried out by the measuring program by blocking a ring port in order thus to provoke a ring reconfiguration that utilizes a reconfiguration time. The blockage of the ring port is canceled again after the reconfiguration time has elapsed. The ring port is blocked again if the ring port has been opened by the ring reconfiguration, and all routing tables are deleted. As a result of this, at least the peripheral units are triggered to learn new network routes. Runtimes of test telegrams are measured, and a maximum value of the measured runtimes is stored. The measured maximum value is used for a dynamic adjustment of the monitoring time.

This application claims the benefit of EP 17190886.6, filed on Sep. 13,2017, which is hereby incorporated by reference in its entirety.

BACKGROUND

The present embodiments relate to operating a program-controlled highlyavailable automation system for a technical process.

A system is considered to be highly available if an applicationcontinues to be available in the event of a fault and may be usedfurther without immediate human intervention. A user may perceive no oronly a minimal interruption. If an automation device is to fail in thecase of a highly available automation system, the system seamlesslyswitches to the second automation device in order to control thetechnical process. High availability accordingly signifies the abilityof a system to provide unrestricted operation in the event of failure ofone of its components.

Both automation devices use the ring for a communication both for dataexchange with the peripheral units and also for the exchange ofsynchronization information. One essential measure in a redundantautomation system is the mutual monitoring of the subsystems (e.g., theautomation devices) using a watchdog, which identifies, via a timeout,whether the respective other subsystem (e.g., automation device) hasfailed. A “failover” (e.g., the takeover of the process control by oneof the two subsystems in the event of the failure of one of the twosubsystems) may be carried out together with internal diagnosismeasures.

The shorter the timeout is set for the watchdog, the quicker a“failover” maybe carried out. The minimal timeout to be selected for thewatchdog is to take into account the conditions of the communicationinfrastructure. By way of example, the following embodiment may beassumed for the communication ring: An MRP ring connects the twoautomation devices and the peripheral units. The MRP ring is configuredaccording to IEC 62439-2. Communication provided via the MRP rings(e.g., multi redundancy protocol) makes it possible for the twoautomation devices to still communicate with one another via a protocolindependent of the MRP ring, and in the process, to use existing ringsegments in parallel, if necessary.

In order to cope with the failure of a ring segment (e.g., the failureof a peripheral unit), the MRP ring responds with a ringreconfiguration. With such a ring reconfiguration, no communicationbetween the two automation devices is possible under certaincircumstances for time periods of differing lengths. The maximum timeperiod determines the minimal value of the watchdog timeout for themutual monitoring of the two automation devices. This time perioddepends inter alia on the devices used in the MRP ring. Since devices inthe MRP ring may be replaced during the service life of the system, thelength of the communication interruption to be expected may also change.This makes a dynamic adjustment of the timeout necessary or requiresinspection of the timeout, in order to promptly identify a possibleworsening of the failover times.

SUMMARY AND DESCRIPTION

The scope of the present invention is defined solely by the appendedclaims and is not affected to any degree by the statements within thissummary.

The present embodiments may obviate one or more of the drawbacks orlimitations in the related art. For example, a method for a dynamicadjustment of monitoring times for the synchronization in a redundantautomation system is provided.

A measuring program is operated at least in one of the two automationdevices. A desired ring interruption is carried out by a blocking of aring port by the measuring program in order thus to provoke a ringreconfiguration that utilizes a ring reconfiguration time. Using themeasuring program, after the reconfiguration time has elapsed, theblockage of the ring port blocked by the measuring program is canceledagain, whereupon the ring port, which was operated previously blocked sothat circulating telegrams in the ring are prevented, is blocked againif the ring port has been opened by the ring reconfiguration and allrouting tables are deleted. As a result of this, at least the peripheralunits are triggered to learn new network routes. Runtimes of testtelegrams are measured by the measuring program, and a maximum value ofthe measured runtimes is stored. The measured maximum value is now usedfor a dynamic adjustment of the monitoring time. Without the dynamicadjustment in the method of the present embodiments, the monitoring time(e.g., watchdog timeout) may be adjusted to the maximum duration of thering interruption to be expected, which renders the failover timesunnecessary. This results in the use of the highly available automationsystem not being possible in certain, time-critical applications.

An advantageous application of the method is provided with an initialoperation of a highly available system, because an optimal monitoringtime may thus be determined. Alternatively, it is also advantageous touse the method if, following a ring failure (e.g., with a subsequentrepair and/or replacement of peripheral units), the physical conditionsof the ring have changed.

The properties of the ring subscribers may have changed, for example,after repair of the ring, possibly longer cables have been fed in, orthe replacement of a ring subscriber with another version number andanother internal software has provided that runtimes are longer.

An MRP ring may be used to couple the two automation devices and theperipheral unit, and one of the two automation devices is operated as anMRP manager, and the other automation device, as well as all remainingperipheral units, in each case operate as an MRP client.

The MRP manager blocks one of the corresponding ring ports, within thescope of the ring design, in order to prevent circulating telegrams inthe ring. The functionality for dynamically adjusting the monitoringtimes is realized in the automation device that the MRP client roleoccupies (e.g., accordingly the second automation device). The measuringprogram of the second automation device may be able to influence thering ports of the second automation device such that a ring interruptionmay be provoked (port set to blocked).

In a further embodiment of the method, the first automation device mayconvey to the measuring program of the second automation device which ofits two ring ports is operated as blocked, and the measuring program mayblock the ring ports of the second automation device according to thefollowing rule: If the first ring port of the first automation device isblocked, the second ring port of the second automation device is blockedfor a ring interruption; and if the second ring port of the firstautomation device is blocked, the first ring port of the secondautomation device is blocked for a ring interruption.

On account of the blocked ring port of the first automation device, thering breaks down into a first ring segment and a second ring segment.Accordingly, the ring is operated in a first ring segment and a secondring segment, and as a result, an interruption in the ring may beidentified because with an interruption, the second automation devicemay then only communicate with the first automation device via one ofthe two ring segments.

If a change in the monitoring time has been identified and themonitoring unit has changed toward larger values, a warning is generatedfor a user of a highly available automation system.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows one embodiment of a highly available automation system;

FIG. 2 shows the highly available automation system according to FIG. 1in method act “identifying an interruption”;

FIG. 3 shows exemplary identification of a successful repair;

FIG. 4 shows a reconfiguration of the ring of the highly availableautomation system;

FIG. 5 shows an exemplary learning phase for learning new routingtables; and

FIG. 6 shows an exemplary of the takeover of a maximum telegram runtimeas a new monitoring time.

DETAILED DESCRIPTION

According to FIG. 1, a highly available automation system 1 is shown.The highly available automation system 1 includes a first automationdevice A, a second automation device B, a first peripheral unit PE1, asecond peripheral unit PE2 and a third peripheral unit PE3. Forcommunication purposes, the automation devices A, B and the peripheralunits PE1, PE2, PE3 are connected with one another via a ring R.

In terms of communication, a media redundancy protocol (MRP) for theexisting ring topology is used on the ring R. The medium redundancyprotocol is a protocol for highly available networks, as are used incritical automation applications. The availability is increased byintegrating redundancy. MRP allows individual failures to be compensatedin a simple ring topology. Since no meshed topologies are assisted, MRPis deterministic and simpler than route spanning tree protocol (RSTP).

The MRP is based on a ring topology and provides recovery times between200 ms and 500 ms (depending on configuration). MRP uses a redundancymanager that closes the ring. During normal operation, the redundancymanager verifies the continuity of the ring by special test packets. Theredundancy manager does not forward packets, however, and thereforeprevents these from circulating endlessly in the ring.

If a subscriber or a line fails, the test packets transmitted to a portare no longer received at another port. From now on, the redundancymanager forwards the packets in both directions and informs thesubscribers of the topology change, so that the subscribers do not sendpackets over the interrupted path but instead via the redundancymanager.

Accordingly, in accordance with FIG. 1, the first automation device A isconfigured as an MRP manager and the second automation device B isconfigured as an MRP client. The peripheral units PE1, PE2, PE3 arelikewise configured as the MRP client. For the physical formation of thering R, the first automation device A has a first ring port A1, which isconnected to a first ring port B1 of the second automation device B. Asecond ring port B2 of the second automation device B is in turnconnected to a second ring port E2 of the third peripheral unit PE 3. Afirst ring port E1 of the third peripheral unit PE3 is connected to asecond ring port D2 of the second peripheral unit PE 2. A first ringport D1 is in turn connected to a second ring port C2 of the firstperipheral unit PE1. A first ring port C1 of the first peripheral unitPE1 is connected to a second ring port A2 of the first automation deviceA. As a result of this, in principle, the ring R physically closes.

In order to carry out the method, the first automation device A has afirst measuring program M_(A) and the second automation device B has asecond measuring program M_(B). With the highly available automationsystem 1, one of the two automation devices A, B may preferentiallycontrol a technical process via the peripheral units PE1, PE2, PE3, andthe two automation devices A, B mutually monitor for failure of therespective other automation device A, B. A monitoring request WD1 fromthe first automation device A to the second automation device B and asecond monitoring request WD2 from the second automation device B to thefirst automation device A is to be responded to within a monitoring timeT0. To this end, the automation devices A, B each have a monitoring unitÜ_(A),Ü_(B). A watchdog function is realized in the monitoring unitsÜ_(A),Ü_(B) in each case, and monitoring is carried out based on themonitoring time T0.

The second ring port A2 of the first automation device A is operated asblocked, so that circulating telegrams in the ring R are prevented. Theautomation devices A, B and the peripheral units PE1, PE2, PE3additionally have routing tables RT.

The two automation devices A, B use the ring R both for data exchangewith the peripheral units PE1, PE2, PE3 and also for exchangingsynchronization information. The mutual monitoring of the automationdevices A, B using a watchdog identifies, via a timeout, whether therespective other automation device A, B has failed. Together withinternal diagnosis measures, a “failover” (e.g., the takeover of theprocess controller by one of the two automation devices A, B) may becarried out in the event of failure of one of the two automation devicesA, B.

The shorter the timeout is set for the watchdog, the quicker a“failover” may be carried out. The minimal timeout to be selected forthe watchdog is to take into account the conditions of the communicationinfrastructure. For the communication, the MRP ring according to IEC62439-2 is assumed to be an example of the following embodiments. It isassumed that the two automation devices A, B communicate with oneanother via a protocol independent of the MRP ring and in the processuse a first ring segment RA1 and a second ring segment RA2 in parallel.On account of the blocked first ring port A2 of the second automationdevice A, the ring R is operated in a first ring segment RA1 and asecond ring segment RA2, and as a result, an interruption of the ring Rmay be identified because with an interruption, the second automationdevice B may then only communicate with the first automation device Avia one of the two ring segments RA1, RA2. In order to cope with afailure of a ring segment (e.g., the failure of a peripheral unit PE1,PE2, PE3), the MRP ring responds with a ring reconfiguration. With sucha ring reconfiguration, no communication between the two automationdevices A, B is possible under certain circumstances for a time periodof differing lengths. The maximum length of this time period determinesthe minimal value of the watchdog timeout (e.g., the monitoring time T0)for the mutual monitoring of the two automation devices A, B. This timeperiod depends inter alia on the devices used in the MRP ring. Sincedevices in the MRP ring may be replaced during the service life of thesystem or the highly available automation system for the system or forthe technical process, the length of the communication interruption tobe expected may also change. This makes a dynamic adjustment of thetimeout or the monitoring time T0 necessary or requires inspection ofthe timeout in order to promptly identify a possible worsening of thefailover times. In one embodiment, a method for operating aprogram-controlled, highly available automation system designedredundantly with a first automation device A and a second automationdevice B schedules a technical process, in which a new monitoring timeto be measured is measured after a possible repair or replacement of adevice and the monitoring time T0 is adjusted in the event of a change.

According to FIG. 2, it is shown how the second measuring program M_(B)of the second automation device B identifies an interruption in the ringR. The interruption in the ring R is shown symbolically. As a result ofthis, the first peripheral unit PE1 has been removed. The secondmeasuring program M_(B) is configured to identify the interruption inthe ring R, in that the first automation system A may then onlycommunicate with the second automation system B via one of the two ringsegments RA1 or RA2. The first measuring program M_(A) may be programmedon the first automation device A such that the first measuring programM_(A) may convey to the second measuring program M_(B) on the secondautomation device B which ring port A1, A2 of the first automationsystem A is currently operated as blocked (e.g., port blocked).

A next method act is indicated with FIG. 3. In the first instance, thering R is repaired. This is indicated symbolically in that a new firstperipheral unit PEP has now been used (shown hatched). If the repair ofthe ring R has been identified by the second measuring program M_(B) onthe second automation device B, the second measuring program M_(B) asksthe first measuring program M_(A) which ring port on the firstautomation device A is currently blocked.

The second measuring program M_(B) is programmed such that the secondmeasuring program M_(B) may measure a measurement for possible newtelegram runtimes Tu. The second measuring program M_(B) only starts ameasurement after a wait time. The wait time serves to allow for anupdate of the process values prior to the measurement, since tworeconfigurations may possibly connect directly to one another on accountof the measurement. The wait time is geared to the maximum projectedupdate times of a possible Profinet periphery.

With a query AF, the second measuring program M_(B) may ask the firstmeasuring program M_(A) which ring port A1, A2 is operated as blocked.

According to FIG. 4, it is shown how the second measuring program M_(B)provokes a desired ring interruption by blocking the first ring port B1of the second automation device B. This ring interruption utilizes areconfiguration time of 200 ms. The reconfiguration RC of the overallring R is indicated by a dashed line and extends across all connectedsubscribers.

FIG. 5 shows how, after the reconfiguration time RC has elapsed, theblockage of the first ring port B1 blocked by the second measuringprogram M_(B) is canceled again, and thereupon, the second ring port A2of the first automation device A, which has previously been operatedblocked, so that circulating telegrams in the ring R are prevented, isblocked again if the second ring port A2 has been opened by the ringreconfiguration. All routing tables RT are now deleted. As a result ofthis, at least the peripheral units PE1, PE2, PE3 are triggered to learnnew network routes in a learning phase LP. With this learning of newnetwork routes, runtimes of test telegrams TT are measured using thesecond measuring program M_(B) (see representation in FIG.1—transmission of test telegrams TT with telegram runtimes T_(1z)). Amaximum value of the measured telegram runtimes T_(1zmax) may be storedby transmitting the test telegrams TT and the measured telegram runtimesT_(1z). The maximum value of the telegram runtimes T_(1zmax) that isdetermined in this way is used for a dynamic adjustment of themonitoring time T0. This is indicated by arrows. As a result of this,the second measuring program M_(B) enters a maximum telegram runtimeT_(1zmax) into the respective monitoring units Ü_(A),Ü_(B) as amonitoring time T0.

FIG. 6 shows that new updated, modified routing tables RT′ are enteredinto the subscribers of the ring by the reconfiguration phase and thelearning phase LP (see FIG. 5).

The method may be carried out with each initial operation of a systemand after each ring interruption with a subsequent repair; with therepair, it is not to be ruled out that the properties of the ringsubscriber have changed and these changes have an effect on the runtimeof telegrams.

It is to be understood that the elements and features recited in theappended claims may be combined in different ways to produce new claimsthat likewise fall within the scope of the present invention. Thus,whereas the dependent claims appended below depend from only a singleindependent or dependent claim, it is to be understood that thesedependent claims may, alternatively, be made to depend in thealternative from any preceding or following claim, whether independentor dependent, and that such new combinations are to be understood asforming a part of the present specification.

While the present invention has been described above by reference tovarious embodiments, it may be understood that many changes andmodifications may be made to the described embodiments. It is thereforeintended that the foregoing description be regarded as illustrativerather than limiting, and that it be understood that all equivalentsand/or combinations of embodiments are intended to be included in thisdescription.

The invention claimed is:
 1. A method for operating a program-controlledhighly available automation system configured redundantly with a firstautomation device and a second automation device, for a technicalprocess, wherein one automation device of the first automation deviceand the second automation device preferentially controls the technicalprocess via peripheral units, and the first automation device and thesecond automation device mutually monitor for failure of the respectiveother automation device of the first automation device and the secondautomation device, wherein a monitoring query from the first automationdevice to the second automation device, and vice versa, is to beresponded to within a monitoring time, wherein for a communication, thefirst automation device and the second automation device, and theperipheral units are connected with one another via a ring, wherein thefirst automation device and the second automation device each have afirst ring port and a second ring port in order to form the ring,wherein one ring port of the first ring ports and the second ring portsis operated as blocked so that circulating telegrams are prevented inthe ring, wherein the first automation device and the second automationdevice, and the peripheral units also have routing tables, wherein ameasuring program is operated in at least in one automation device ofthe first automation device and the second automation device, the methodcomprising: carrying out a desired ring interruption, the carrying outof the desired ring interruption comprising blocking, by the measuringprogram, a ring port to provoke a ring reconfiguration that utilizes areconfiguration time; canceling, by the measuring program, the blockageof the ring port blocked by the measuring program after thereconfiguration time has elapsed; blocking the ring port that haspreviously been operated blocked so that circulating telegrams in thering are prevented again when the ring port is opened by the ringreconfiguration and deleting all routing tables, and as a result ofwhich at least the peripheral units are triggered to learn new networkroutes; measuring runtimes of test telegrams and storing, by themeasuring programs, a maximum value of the measured runtimes; and usingthe measured maximum value for a dynamic adjustment of the monitoringtime.
 2. The method of claim 1, wherein the method is applied, with aninitial operation, such that an optimal monitoring time is determined,or the method is applied following a ring failure with subsequentrepair, replacement, or repair and replacement of the peripheral units.3. The method of claim 1, wherein an MRP ring is used to couple thefirst automation device and the second automation device, wherein someof the peripheral units and one automation device of the firstautomation device and the second automation device is operated as an MRPmanager, and the other automation device of the first automation deviceand the second automation device, and the remaining peripheral units areoperated as an MRP client, respectively.
 4. The method of claim 2,wherein an MRP ring is used to couple the first automation device andthe second automation device, wherein some of the peripheral units andone automation device of the first automation device and the secondautomation device is operated as an MRP manager, and the otherautomation device of the first automation device and the secondautomation device, and the remaining peripheral units are operated as anMRP client, respectively.
 5. The method of claim 1, wherein the firstautomation device is configured to convey to the measuring program ofthe second automation device which of the two ring ports of the firstautomation device is operated as blocked, and the measuring programblocks the ring ports of the second automation device according to thefollowing rule: if the first ring port is blocked, the second ring portis blocked for a ring interruption; and if the second ring port isblocked, the first ring port is blocked for a ring interruption.
 6. Themethod of claim 2, wherein the first automation device is configured toconvey to the measuring program of the second automation device which ofthe two ring ports of the first automation device is operated asblocked, and the measuring program blocks the ring ports of the secondautomation device according to the following rule: if the first ringport is blocked, the second ring port is blocked for a ringinterruption; and if the second ring port is blocked, the first ringport is blocked for a ring interruption.
 7. The method of claim 3,wherein the first automation device is configured to convey to themeasuring program of the second automation device which of the two ringports of the first automation device is operated as blocked, and themeasuring program blocks the ring ports of the second automation deviceaccording to the following rule: if the first ring port is blocked, thesecond ring port is blocked for a ring interruption; and if the secondring port is blocked, the first ring port is blocked for a ringinterruption.
 8. The method of claim 1, wherein on account of theblocked ring port of the first automation device, the ring is operatedin a first ring segment and a second ring segment, and as a result, aninterruption of the ring is identified because with an interruption thesecond automation device is operable to only communicate with the firstautomation device via one of the two ring segments.
 9. The method ofclaim 2, wherein on account of the blocked ring port of the firstautomation device, the ring is operated in a first ring segment and asecond ring segment, and as a result, an interruption of the ring isidentified because with an interruption the second automation device isoperable to only communicate with the first automation device via one ofthe two ring segments.
 10. The method of claim 3, wherein on account ofthe blocked ring port of the first automation device, the ring isoperated in a first ring segment and a second ring segment, and as aresult, an interruption of the ring is identified because with aninterruption the second automation device is operable to onlycommunicate with the first automation device via one of the two ringsegments.
 11. The method of claim 5, wherein on account of the blockedring port of the first automation device, the ring is operated in afirst ring segment and a second ring segment, and as a result, aninterruption of the ring is identified because with an interruption thesecond automation device is operable to only communicate with the firstautomation device via one of the two ring segments.
 12. The method ofclaim 1, further comprising generating a warning for a user in the eventof a change in the monitoring time to greater values.
 13. The method ofclaim 2, further comprising generating a warning for a user in the eventof a change in the monitoring time to greater values.
 14. The method ofclaim 3, further comprising generating a warning for a user in the eventof a change in the monitoring time to greater values.
 15. The method ofclaim 5, further comprising generating a warning for a user in the eventof a change in the monitoring time to greater values.
 16. The method ofclaim 8, further comprising generating a warning for a user in the eventof a change in the monitoring time to greater values.